CVEvulnerability
CVE-2015-3252
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2016-02-08
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.0 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-255
Description
Apache CloudStack before 4.5.2 does not properly preserve VNC passwords when migrating KVM virtual machines, which allows remote attackers to gain access by connecting to the VNC server.
Affected configurations
• apache cloudstack (<= 4.5.1)
Related
Weakness · not in database (1)
References
- http://mail-archives.apache.org/mod_mbox/cloudstack-users/201602.mbox/%3C7508580E-3D83-49FD-BE6E-B329B0503130%40gmail.com%3E Vendor Advisory
- http://www.securityfocus.com/archive/1/537459/100/0/threaded www.securityfocus.com
- https://blogs.apache.org/cloudstack/entry/two_late_announced_security_advisories Vendor Advisory
- http://mail-archives.apache.org/mod_mbox/cloudstack-users/201602.mbox/%3C7508580E-3D83-49FD-BE6E-B329B0503130%40gmail.com%3E Vendor Advisory
- http://www.securityfocus.com/archive/1/537459/100/0/threaded www.securityfocus.com
- https://blogs.apache.org/cloudstack/entry/two_late_announced_security_advisories Vendor Advisory